Explorer.exe crashes, Fault Module SHELL32.dll, no problem in other User Account

Question

After upgrading to Windows 11 and personalizing the UI on an account, explorer.exe crashes several times a second.

Account is not usable as task list can't be even build up, the only thing I get is the mouse pointer and the loading circle.

At least I'm able to start the task manager with Ctrl+Alt+Del.

Event viewer reports failure of explorer.exe because of SHELL32.dll.

Process crash dump analysis attached.

Has anybody an idea what to do next?

---

0:000> !analyze -v

---

• *
• Exception Analysis *
• *

  ---

KEY_VALUES_STRING: 1

Key  : AV.Dereference
Value: NullPtr

Key  : AV.Fault
Value: Read

Key  : Analysis.CPU.mSec
Value: 7796

Key  : Analysis.DebugAnalysisManager
Value: Create

Key  : Analysis.Elapsed.mSec
Value: 207151

Key  : Analysis.Init.CPU.mSec
Value: 718

Key  : Analysis.Init.Elapsed.mSec
Value: 42482

Key  : Analysis.Memory.CommitPeak.Mb
Value: 550

Key  : Timeline.Process.Start.DeltaSec
Value: 2

Key  : WER.OS.Branch
Value: co_release

Key  : WER.OS.Timestamp
Value: 2021-06-04T16:28:00Z

Key  : WER.OS.Version
Value: 10.0.22000.1

Key  : WER.Process.Version
Value: 10.0.22000.100

NTGLOBALFLAG: 0

APPLICATION_VERIFIER_FLAGS: 0

CONTEXT: (.ecxr)
rax=0000000000000000 rbx=0000000000000000 rcx=6df0be95c0800000
rdx=0000000000000000 rsi=0000000000fbc360 rdi=0000000000000000
rip=00007ffa42047d3b rsp=0000000000fbc260 rbp=0000000003e0c300
r8=0000000001373e40 r9=0000000000000001 r10=0000000001370000
r11=0000000000fbbb50 r12=0000000000fbced4 r13=0000000000fbc9f0
r14=0000000003d02100 r15=0000000003d02190
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
shell32!Ordinal244+0x3b7b:
00007ffa42047d3b 488b07 mov rax,qword ptr [rdi] ds:0000000000000000=????????????????
Resetting default scope

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ffa42047d3b (shell32!Ordinal244+0x0000000000003b7b)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME: explorer.exe

READ_ADDRESS: 0000000000000000

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE_STR: c0000005

EXCEPTION_PARAMETER1: 0000000000000000

EXCEPTION_PARAMETER2: 0000000000000000

STACK_TEXT:
0000000000fbc260 00007ffa42047cac : 0000000000000000 00000000013611b0 0000000003e0c300 0000000000000000 : shell32!Ordinal244+0x3b7b
0000000000fbc2d0 00007ffa42047b92 : 0000000000000000 0000000000000000 0000000003d02180 0000000000000000 : shell32!Ordinal244+0x3aec
0000000000fbc330 00007ffa42047a49 : 0000000000270026 0000000000000000 0000000000000000 0000000000fbc440 : shell32!Ordinal244+0x39d2
0000000000fbc3a0 00007ffa42060f16 : 000000008000ffff 0000000000000000 0000000000001000 00007ffa43624710 : shell32!Ordinal244+0x3889
0000000000fbc3e0 00007ffa41ff444b : 0000000003d02180 0000000000fbc700 0000000000000000 0073007200650073 : shell32!Ordinal915+0x6f16
0000000000fbc410 00007ffa41ff42ee : 0000000000000000 0000000000000000 0000000003d02180 0000000000fbc70c : shell32!SHCreateDefaultContextMenu+0x2c0b
0000000000fbc680 00007ffa41fed7ab : 0000000000000000 0000000000fbc7c0 0000000003cfaa30 0000000000fbc7c0 : shell32!SHCreateDefaultContextMenu+0x2aae
0000000000fbc6c0 00007ffa41fed3ad : 0000000000000000 0000000000000000 0000000000000000 0000000000000001 : shell32!Ordinal787+0x80b
0000000000fbc980 00007ffa42045790 : 00007ffa426ecde8 00007ffa426ecde8 0000000000000000 0000000003cfaa30 : shell32!Ordinal787+0x40d
0000000000fbca90 00007ffa42042c3f : 0000000000000000 fffffffff6010718 0000000000000000 0000000003cfaa30 : shell32!Ordinal244+0x15d0
0000000000fbcde0 00007ffa420431ca : 0000000000000000 fffffffff6010718 0000000004944ce8 00007ffa436122d5 : shell32!SHELL32_AreAllItemsAvailable+0x16df
0000000000fbcfb0 00007ffa4204388a : 0000000000000060 00007ffa4360e395 fffffffffca51c47 0000000000000000 : shell32!SHELL32_AreAllItemsAvailable+0x1c6a
0000000000fbd150 00007ffa4204337c : 0000000000000001 0000000000000000 0000000000c200d8 0000000000000000 : shell32!SHELL32_AreAllItemsAvailable+0x232a
0000000000fbd290 00007ffa43611a6c : 0000000000000001 0000000000000001 0000000000fbd4a8 0000000000000000 : shell32!SHELL32_AreAllItemsAvailable+0x1e1c
0000000000fbd2e0 00007ffa43610803 : 0000000000000000 00007ffa42043320 0000000000c200d8 0000000000000014 : user32!UserCallWinProcCheckWow+0x33c
0000000000fbd450 00007ffa43610557 : 000000000199c9b0 0000000000000000 fffffffff6010718 0000000000000000 : user32!SendMessageWorker+0x243
0000000000fbd4f0 00007ffa4201b6c9 : 0000000000b60070 0000000000c200d8 fffffffff6010718 fffffffff6010718 : user32!SendMessageW+0x137
0000000000fbd550 00007ffa4201e6e5 : fffffffff6010718 0000000000fbd6b1 fffffffff6010718 0000000000fbd6b1 : shell32!Shell_GetImageLists+0x8d9
0000000000fbd600 00007ffa4201e22c : 0000000000000001 0000000000000000 0000000000b60070 0000000000000000 : shell32!SHELL32_RefreshOverlayImages+0x2665
0000000000fbd710 00007ffa43611a6c : 0000000000000001 0000000000000001 fffffffff6010718 0000000000000000 : shell32!SHELL32_RefreshOverlayImages+0x21ac
0000000000fbd760 00007ffa436116be : 0000000000b60070 00007ffa4201e1d0 0000000000b60070 00007ffa00000014 : user32!UserCallWinProcCheckWow+0x33c
0000000000fbd8d0 00007ffa299248a8 : 0000000000000001 0000000000000000 0000000000fbddc0 000000000198bdc0 : user32!CallWindowProcW+0x8e
0000000000fbd920 00007ffa299247d8 : 0000000000000001 0000000003cff2a0 0000000000b60070 0000000000000000 : comctl32!CallNextSubclassProc+0xa8
0000000000fbd9a0 00007ffa42020656 : 000000000498ec80 0000000000fbdaf0 0000000000000000 0000000000000000 : comctl32!DefSubclassProc+0x88
0000000000fbd9f0 00007ffa42020533 : 0000000002f30000 0000000000000003 0000000002f367c0 000000000c00000c : shell32!SHELL32_RefreshOverlayImages+0x45d6
0000000000fbdcb0 00007ffa299248a8 : 0000000000000001 00007ffa43612206 0000000000000003 00007ffa4361a77a : shell32!SHELL32_RefreshOverlayImages+0x44b3
0000000000fbdcf0 00007ffa29924697 : 0000000000000001 fffffffff6010718 0000000000b60070 0000000000000000 : comctl32!CallNextSubclassProc+0xa8
0000000000fbdd70 00007ffa43611a6c : 0000000000b60070 0000000000000001 0000000000000001 0000000000000000 : comctl32!MasterSubclassProc+0xa7
0000000000fbde10 00007ffa43610803 : 00000000049ca280 00007ffa299245f0 0000000000b60070 0000000000000014 : user32!UserCallWinProcCheckWow+0x33c
0000000000fbdf80 00007ffa43610557 : 000000000199cc90 0000000000000000 fffffffff6010718 0000000000000000 : user32!SendMessageWorker+0x243
0000000000fbe020 00007ffa29900d4e : fffffffff6010718 0000000000fbe189 0000000003cad2b0 0000000000fbe290 : user32!SendMessageW+0x137
0000000000fbe080 00007ffa29900bb7 : 0000000000000000 0000000000000000 fffffffff6010718 0000000000fbe100 : comctl32!CLVBackgroundManager::DrawSimpleBackground+0xc2
0000000000fbe0d0 00007ffa299011af : 0000000003c63e00 0000000000000000 0000000077011944 0000000003c63e00 : comctl32!CLVBackgroundManager::DrawBackground+0xd7
0000000000fbe1f0 00007ffa29901055 : 0000000003c63e00 0000000077011944 0000000003c88210 0000000003c63e00 : comctl32!CLVDrawManager::_PaintWorkArea+0xbf
0000000000fbe270 00007ffa29900f1b : 0000000003c63e00 0000000003c88210 0000000040000000 0000000003c63e00 : comctl32!CLVDrawManager::_OnPaintWorkAreas+0xf1
0000000000fbe300 00007ffa29900dff : 0000000000aa0560 0000000003c88210 0000000003c63e00 0000000000000000 : comctl32!CLVDrawManager::_OnPaint+0xbf
0000000000fbe3b0 00007ffa2990291c : 0000000000aa0560 00007ffa43e66fc4 00006df000000014 000000000199caa0 : comctl32!CLVDrawManager::OnPaint+0x57
0000000000fbe3e0 00007ffa299018cf : 0000000000000001 000000000000000f 0000000000aa0560 00007ffa43611d3b : comctl32!CListView::WndProc+0xacc
0000000000fbe5d0 00007ffa43611a6c : 0000000000000001 0000000000000000 0000000000000000 0000000080000022 : comctl32!CListView::s_WndProc+0x6f
0000000000fbe620 00007ffa436116be : 0000000000003d88 00007ffa29901860 0000000000aa0560 00007ffa0000000f : user32!UserCallWinProcCheckWow+0x33c
0000000000fbe790 00007ffa299248a8 : 0000000000000001 0000000000aa0560 0000000000fbebc0 0000000000fbeb90 : user32!CallWindowProcW+0x8e
0000000000fbe7e0 00007ffa29924579 : 0000000000000001 000000000000000f 0000000000000000 0000000004945b30 : comctl32!CallNextSubclassProc+0xa8
0000000000fbe860 00007ffa299248a8 : 0000000000000001 0000000000000000 0000000000fbee60 0000000000fbee60 : comctl32!TTSubclassProc+0xc9
0000000000fbe910 00007ffa299247d8 : 0000000000000001 0000000004945b30 0000000000aa0560 0000000000000000 : comctl32!CallNextSubclassProc+0xa8
0000000000fbe990 00007ffa4201da91 : 000000000000000f 0000000000fbea99 0000000000000000 00007ffa43cc67d5 : comctl32!DefSubclassProc+0x88
0000000000fbe9e0 00007ffa299248a8 : 000000000198bdc0 00007ffa43612206 0000000002f30900 00007ffa4361a77a : shell32!SHELL32_RefreshOverlayImages+0x1a11
0000000000fbeaf0 00007ffa29924697 : 0000000000000001 0000000000000000 0000000000aa0560 0000000000000000 : comctl32!CallNextSubclassProc+0xa8
0000000000fbeb70 00007ffa43611a6c : 0000000000aa0560 0000000000000001 0000000000000001 0000000000000000 : comctl32!MasterSubclassProc+0xa7
0000000000fbec10 00007ffa436115bc : 0000000000000000 00007ffa299245f0 0000000000aa0560 000000000000000f : user32!UserCallWinProcCheckWow+0x33c
0000000000fbed80 00007ffa4362496d : 0000000000000000 0000000000000000 0000000000000000 00007ffa43695000 : user32!DispatchClientMessage+0x9c
0000000000fbede0 00007ffa43e66fc4 : 00007ffa415a1dd4 000000000199caa0 0000000000c200d8 00007ffa43613d5f : user32!_fnDWORD+0x3d
0000000000fbee40 00007ffa415ac6d4 : 00007ffa420775cf 0000000004944ca0 00007ffa43de7511 0000000003d54360 : ntdll!KiUserCallbackDispatcherContinue
0000000000fbeec8 00007ffa420775cf : 0000000004944ca0 00007ffa43de7511 0000000003d54360 00000000000004a5 : win32u!NtUserUpdateWindow+0x14
0000000000fbeed0 00007ffa42043944 : 0000000000000000 000000000000045c 000000000000031f 000000000498ec80 : shell32!SHGetItemFromObject+0xa79f
0000000000fbef00 00007ffa4204337c : 0000000000000001 0000000000000000 0000000000c200d8 0000000000000000 : shell32!SHELL32_AreAllItemsAvailable+0x23e4
0000000000fbf040 00007ffa43611a6c : 0000000000000001 0000000000000001 0000000000fbf430 0000000000000000 : shell32!SHELL32_AreAllItemsAvailable+0x1e1c
0000000000fbf090 00007ffa43610cc6 : 0000000000fbf2b8 00007ffa42043320 0000000000c200d8 000000000000045c : user32!UserCallWinProcCheckWow+0x33c
0000000000fbf200 00007ffa420015be : 00007ffa42043320 0000000004944ca0 000000000000029c 000000000000029c : user32!DispatchMessageWorker+0x2a6
0000000000fbf280 00007ffa4200144d : 0000000003c62390 0000000003c64950 0000000004944ca0 000000000000029c : shell32!Ordinal201+0x1ae
0000000000fbf300 00007ff783717ddf : 0000000000000000 0000000000000bea 0000000000000000 000000000000029c : shell32!Ordinal201+0x3d
0000000000fbf330 00007ff78374cd20 : 0000000000000005 0000000000000000 0000000000000000 0000000000000000 : explorer!wWinMain+0x817
0000000000fbf780 00007ffa42bd54e0 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : explorer!__scrt_common_main_seh+0x110
0000000000fbf7c0 00007ffa43dc485b : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : kernel32!BaseThreadInitThunk+0x10
0000000000fbf7f0 0000000000000000 : 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : ntdll!RtlUserThreadStart+0x2b

SYMBOL_NAME: shell32!Ordinal244+3b7b

MODULE_NAME: shell32

IMAGE_NAME: shell32.dll

STACK_COMMAND: ~0s ; .ecxr ; kb

FAILURE_BUCKET_ID: NULL_POINTER_READ_c0000005_shell32.dll!Ordinal244

OS_VERSION: 10.0.22000.1

BUILDLAB_STR: co_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

IMAGE_VERSION: 10.0.22000.100

FAILURE_ID_HASH: {e21b2215-09c8-8fe7-324b-7b385b31898b}

Followup: MachineOwner

---

Answer 1

Thank you for sharing, this is a bug and make sure report it using the Feedback Hub app and make sure include dump files.